Privacy at Abridge

Abridge is a company founded by patients, doctors, researchers, and technologists. We believe that patients should have the power to control their health information through technology. Patients should also be an equal partner in relationships with their care providers.

We leverage groundbreaking technologies to help people remember the important details from their health conversations, so they can better follow their care plan. With more context and understanding of medical conversations, we hope to help everyone achieve better health outcomes.

How Abridge protects your privacy

These five Privacy Principles guide all decisions we make as we build and improve Abridge:

1. You own and control when your data is collected and how it is shared. Whether in the Abridge App or the Telehealth Services, we only collect and share personal health data with your consent. We use privacy by design principles to limit the data we collect and to give you notice in the App when you have choices to share data.
2. You can change your mind. You can delete recordings or your account at any time.
3. We never sell personal data. We want to be clear on this point. We don’t have a business model that includes making money from selling your identifiable data.
4. Anonymized Data is better. Any research and development is performed on de-identified health data or external data sets that are acquired with patient consent. If we have an opportunity to include your personal data in our research, we will request your consent before we do so.
5. Data Security is not a trade-off. You trust us to keep your data secure and that guides everything we build. Because of that, we apply HIPAA security standards to all health data we collect — even if HIPAA does not apply to our services.

Abridge was created to help patients remember the important details from their health conversations, so they can better follow their care plan. Abridge provides services through the Abridge App (“Abridge App” or “App”) and the Abridge Telehealth Service (“Abridge Telehealth”) (collectively, “the Abridge Services,” “Abridge” or “the Services”). Our goal with this Privacy Policy is to inform you about how Abridge works by explaining the data you provide, data we collect, how we use it to provide the Services and when it is shared.

What personal data does Abridge collect about me?

Account Information. We collect your phone number to create an account and allow you to access it. If you have previously created an account using your name and email address, you may choose to link your phone number in your account settings and access your account via that phone number.

If you are signing up to Abridge as a Verified Health Professional, we may collect additional information in order to authenticate you in our system.

Health Information. When you record a health conversation, we collect the audio and process that into a readable transcript that we store. We use the transcript to create a recording summary which includes your recording, the most important moments from your conversation, and medical mentions, where specific medical terms like diagnoses or medications were recorded.

There are two types of conversations Abridge provides services to:

Abridge App conversations. You can initiate a recording of any health conversation in the Abridge App. It will immediately be available to you when you log in.

Abridge Telehealth conversations. Telehealth conversations are recordings between you and an Abridge Verified Health Professional made using the Abridge App or Abridge Telehealth. You agree to have a telehealth call recorded and automatically shared with your doctor either when you are called through Abridge Telehealth or initiate a telehealth call through the Abridge App. You need to create an account on Abridge to access that conversation. Once you do, you can access and interact with that call the same way you do with conversations recorded in the App; however, you will need to contact your Verified Health Professional directly to delete a Telehealth conversation from the Services once it is shared with him/her.

Your Activity. You can interact with your recordings in several ways in the App to help you organize and find medical mentions. For example, you can add a title, use a suggested tag, edit a medical mention to improve accuracy, or star a particular moment for easy access. We store Your Activity in association with your account.

Contacts. You can choose to share your recording and recording summary with another Abridge user by either manually entering a recipient’s email address or permitting us to access your phone’s contacts so you can choose a recipient. If the recipient is not a current Abridge user, we will send them an email inviting them to join Abridge. We do not store your Contacts, but we need access so you can select recipients. You can stop us from accessing Contacts in your phone’s settings at any time. When you share a recording, we store the recipient’s email address and any message you send in association with your account. You can stop sharing a recording with a Contact who is not a Verified Health Professional at any time in the Abridge App.

Location. For certain features you may choose to share your location. We will notify you before we collect this data.

Analytics and Passively Collected Data. We collect data about how you use Abridge, including your IP address, mobile device ID, click or tap history, type of OS or browser and other actions on the Services. This information is collected from your phone or web browser as you interact with web and mobile apps and helps us improve your experience with the Services.

Feedback and Support. We love to hear from you! Whether you have an idea to make Abridge better or need a little help, we store the emails you send us and use them to help us prioritize how to improve our product.

De-identified Data. De-identified Data is non-personal information that is aggregated or de-identified so that it cannot reasonably be used to identify an individual. We use de-identified data for research and development of new products or tools, to refine our algorithms and machine learning applications, and to improve the App and the services we provide. We may disclose such information publicly and to third parties, for example, in public reports about health, to partners under agreement with us, or in benchmarking information we provide to the medical community.

How does Abridge use personal data?

We process personal data to provide the Service to you:

• We use machine learning to process your audio recording and create a transcript of relevant medical mentions that we provide to you.
• We use your name when you share a recording, so the recipient knows who sent it.
• We use your name, email address, and mobile phone number to manage your account, contact you about your use of Abridge, respond to your requests, and inform you of new features or products.
• We use Analytics and Passively Collected Data to understand how you use Abridge, to test features and tools, ensure Abridge is working properly, and protect it from bad actors.
• We use personal data to improve Abridge. For example: to troubleshoot and protect against errors; perform data analysis and testing; conduct research and surveys; develop new products or tools; and refine our algorithms and machine learning applications.
• We store health conversations and recording summaries that you have shared through a Telehealth conversation with your Verified Health Professional so they have continued access to it. If you do not have an Abridge account, a Telehealth conversation is only used to provide this service to your doctor.
• We use your email address to send you information about Abridge or our Partners. You can opt-out from receiving messages at any time by clicking “unsubscribe” in any email you receive.
• We use personal data to promote the safety and security of Abridge, our users, and other parties. For example, to protect against fraud and abuse, respond to a legal request or claim, conduct audits, and enforce our terms and other policies.

When is my personal data shared?

We never sell personal data. We only share it with your consent or when required or permitted by law.

Here are the circumstances under which your personal data may be shared:

When you consent, agree or direct us to share it. There may be times when you ask us to perform an action that will share your data. For example:

• You may direct us to share a recording with a family member who is an Abridge user. You can revoke this access at any time.
• You may direct us to share a Telehealth conversation with a Verified Health Professional by consenting before the Telehealth conversation is recorded. Once the call is shared with the Verified Health Professional you must contact them directly to delete the conversation.
• The Abridge Service includes links and interactions with third parties that aren’t controlled by Abridge. We partner with these organizations because they provide benefits that we think makes the Abridge experience more beneficial to you. We do not share personal data with partners unless you direct us to do so and we include a link to the partner’s privacy policy in the App so you will know how your data will be used by that partner.

Please note that once your data is shared with a third party, it is covered by any policies that apply to that third party and you will have to contact them directly to access or delete your personal data.

To provide the Abridge Services. We transfer data to service providers and other partners who process it for us, based on our instructions and in compliance with this Privacy Policy and other confidentiality and security measures enforced by legal contract. This processing can include services such as customer support, cloud storage, marketing, data analysis, research, and surveys.

To comply with the Law. We may disclose the information we collect from you in order to comply with the law, a judicial proceeding, court order, or other legal process, such as in response to a court order or a subpoena.

• Please note: Our policy is to notify you of legal process seeking access to your information, such as search warrants, court orders, or subpoenas, unless we are prohibited by law from doing so. In cases where a court order specifies a non-disclosure period, we provide delayed notice after the expiration of the non-disclosure period. Exceptions to our notice policy include exigent or counterproductive circumstances, for example, when there is an emergency involving a danger of death or serious physical injury to a person.

To Protect Us and Others. We may disclose the information we collect from you where we believe it is necessary to investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to the safety of any person, violations of our Terms of Use or this Policy, or as evidence in litigation in which Abridge is involved.

Business Transfers. If we are acquired by or merged with another company, if substantially all of our assets are transferred to another company, or as part of a bankruptcy proceeding or reorganization, we will give affected users notice before transferring any personal data to a new entity.

How do you keep my data safe?

We use a combination of technical, administrative, and physical controls to keep user data secure. Data is always transmitted via secure channels. Data is encrypted in transit and at rest using the industry best practice encryption standards (e.g. S/MIME, X.509 certificates, TLS) to safeguard your information. Data is protected as it travels over the internet during read and write operations using HTTPS. We use HIPAA-compliant products and services for health data storage and processing. In addition to using state-of-the-art security systems, we also have strict internal access-control policies to prevent privacy violations.

How do you protect children?

Abridge is not intended for children. Parents or guardians may open an Abridge account to manage their child’s care, but Abridge is not directed at children under the age of 13. If we become aware that we are collecting data from a child under 13, we will promptly delete the data and the account. If you have reason to believe that a child under the age of 13 provided data to us without parent or guardian consent, please contact us at privacy@abridge.com.

Access to, storage of, and deleting my personal data

You may access and modify personal data that you have submitted by logging into your account and updating your profile information. Please note that copies of information that you have updated, modified or deleted may remain viewable in cached and archived pages of the Service for a period of time. Your personal data is stored and accessible on your device as well as in the cloud.

We store information associated with your account until your account is deleted. You can delete your account at any time from the settings menu in the App or by contacting us at support@abridge.com. Please note that it may take 24 hours to delete your account information, and we may preserve it for legal reasons or to prevent harm, including as described in the “When Is My Personal Data Shared?” section.

Your California privacy rights

This Privacy Policy complies with the California Consumer Privacy Act (CCPA), which requires that we provide California residents with notice that you have the right to:

• opt-out of the sale of personal information,
• know about personal information collected, disclosed or sold,
• request deletion of personal information, and
• be treated without discrimination should you exercise these rights.

More information regarding the: sources from which we collect personal information can be found above in the section titled “What Personal Data Does Abridge Collect About Me?”; business and commercial purposes for which we collect your personal information can be found above in the section titled “How We Use Your Information”; categories of recipients with whom personal information is shared or sold can be found in the section above titled “When Is My Personal Data Shared?”

We do not sell any personal information collected from your use of the Abridge Service.

To make a request under the California Consumer Privacy Act, or for any questions or concerns about our Privacy Policy or practices, please contact us at privacy@abridge.com.

Changes to this policy

We will notify you before we make material changes to this policy and give you an opportunity to review the revised policy before deciding to continue using Abridge. You can review previous versions of the policy in our Archive of Previous Privacy Policies.

Contact us

You can reach us by email at privacy@abridge.com or by post:

Abridge

Attn: Legal -- Privacy

224 N. Euclid Ave.

Suite 311

Pittsburgh, PA 15206